Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
170 results · page 4 of 4
Jul 21, 2021An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read on function ilst_itemCVE-2020-19488 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read on function ilst_item_Read.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box.CVE-2020-19481 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid memory read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box commandCVE-2021-31262 · Other software · Gpac · reported by MITREMedium 5.5
The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.CVE-2021-31261 · Other software · Gpac · reported by MITREMedium 5.5
The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.CVE-2021-31260 · Other software · Gpac · reported by MITREMedium 5.5
The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box CVE-2021-31258 · Other software · Gpac · reported by MITREMedium 5.5
The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.CVE-2021-31257 · Other software · Gpac · reported by MITREMedium 5.5
The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.CVE-2021-31256 · Other software · Gpac · reported by MITREMedium 5.5
Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted fileCVE-2021-31255 · Other software · Gpac · reported by MITREHigh 7.8
Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted fileCVE-2021-31254 · Other software · Gpac · reported by MITREHigh 7.8
Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV sizes.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2020An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box.CVE-2020-11558 · Other software · Gpac · reported by MITRECritical 9.8
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box.CVE-2019-20632 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid pointer dereference in gf_odf_delete_descriptor in odf/desc_private.c that can cause a denial of service via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box.CVE-2019-20631 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid pointer dereference in gf_list_count in utils/list.c that can cause a denial of service via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box.CVE-2019-20630 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BS_ReadByte (called from gf_bs_read_bit) in utils/bitstream.c that can cause a denial of service via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box.CVE-2019-20629 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box.CVE-2019-20628 · Other software · Gpac · reported by MITREMedium 5.5
An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used foCVE-2018-20762 · Other software · Gpac Project · reported by MITREHigh 7.8
GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018An issue was discovered in MP4Box in GPAC 0.7.1.CVE-2018-13006 · Other software · Debian · reported by MITRECritical 9.8
An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 29, 2018An issue was discovered in MP4Box in GPAC 0.7.1.CVE-2018-13005 · Other software · Debian · reported by MITRECritical 9.8
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 6, 2018GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks beingCVE-2018-1000100 · Other software · Gpac Project · reported by MITREHigh 7.8
GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified, this could lead to RCE. This attack appear to be exploitable via an attacker supplied MP4 file that when run by the victim may result in RCE.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comusn.ubuntu.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.